Article 22AI-relevant

Automated individual decision-making, including profiling

Chapter IIIIn force since 25-05-2018

AI Act intersection

Automated decision-making is a core intersection with the AI Act: prohibited practices (Art. 5), human oversight (Art. 14), and deployer obligations (Art. 26).

AI Act Art. 5 →AI Act Art. 14 →AI Act Art. 26 →

Official text

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Paragraph 1 shall not apply if the decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. Section 5 Restrictions

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Assess whether your AI system makes decisions that fall under Art. 22. Implement human oversight, provide data subjects with the right to explanation and objection, and document the logic behind the AI system.

Processor

Ensure technical capabilities to facilitate human intervention. Build in logging so that decisions can be explained afterwards.

Data Protection Officer

Monitor whether AI systems de facto make fully automated decisions, even if they are formally positioned as 'advisory'. Advise on the implementation of Art. 22 safeguards.

Data Subject

If an AI system makes a decision about you with legal effects (e.g. credit denial, job application rejection), you have the right to human intervention, explanation, and the ability to contest the decision.

Compliance checklist

Inventoried which AI systems make decisions with legal effectsHuman oversight implemented for automated decisionsMechanism for data subjects to express their point of viewRight to object and human intervention facilitatedLogic behind AI decisions documented and explainableInformation obligation (Art. 13/14) supplemented with AI-specific information

Related recitals

(71)

The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing an...

(72)

Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles. The European Data Protection Boa...

Cross-references

Art. 9: Processing of special categories of personal data

Frequently asked questions

← Art. 21: Right to object Art. 23: Restrictions →